Fundamental Principles and Concepts of an OH&S Management System
What the system is for
ISO 45001:2018 gives an organization a structured, risk-based framework whose intended outcomes are to prevent work-related injury and ill health to workers and other interested parties, provide safe and healthy workplaces, and continually improve OH&S performance. It does not prescribe a level of safety performance, does not replace legal obligations, and does not require an "OH&S manual".
The standard follows Annex SL (the High Level Structure) with harmonized clauses 4–10 and the Plan–Do–Check–Act cycle: Plan covers clauses 4–6, Do covers 7–8, Check is 9, Act is 10. Two threads run through every clause: risk-based thinking (6.1 actions to address risks and opportunities, not merely a register) and worker consultation and participation (5.4), which is what most sharply distinguishes ISO 45001 from older OH&S standards.
Distinguish hazard (a source with the potential to cause injury and ill health) from OH&S risk (a combination of likelihood and severity), and both from risk to the management system (e.g. the risk that legal updates are missed). Clause 6.1.1 requires the organization to address both, so auditors must keep them separate.
Key traps: "shall" is auditable while "should", "may" and "can" are guidance; proactive hazard identification always outranks waiting for incidents; the hierarchy of controls in 8.1.2 is mandatory and ordered; outsourced processes and contractors remain the organization's responsibility under 8.1.4.
Rule of thumb: for every "shall", ask "show me" - the audit trail must end in objective evidence held by the organization, not in the auditor's inference.